Toolkit · Compliance · about 4 minutes
SOC 2 Readiness Check
A Type II report tests whether your controls worked over a period, not whether they exist today. These questions separate the organisations that are ready from the ones that need to start collecting evidence first.
20 questions. Nothing is sent anywhere as you answer, the scoring runs in your browser, and we only receive anything if you ask for the written version at the end.
Control environment
The organisational foundation the auditor tests everything else against.
Are information security policies documented, approved and communicated to staff?
Is there a documented risk assessment that is reviewed at least annually?
Are background checks and confidentiality agreements in place for staff with system access?
Is there an organisation chart with defined security responsibilities?
Evidence and monitoring
A Type II report tests whether controls worked over a period, not whether they exist today.
Are you collecting evidence continuously (access reviews, ticket records, logs) that covers a period of at least three months?
This is the difference between Type I and Type II. Without a history there is nothing to test.
Is security-relevant logging centralised and retained for at least a year?
Are alerts triaged by a named owner with a recorded outcome?
Do you track vendor SOC 2 reports for subservice organisations you rely on?
Logical access
Who can reach what, and how that is proven.
Is MFA enforced for all production and administrative access?
Are user access reviews performed and recorded at least quarterly?
Is access provisioned from role definitions rather than by copying an existing user?
Is access revoked within one business day of someone leaving, with evidence?
Change management
Changes to production are controlled, reviewed and reversible.
Does every production change go through peer review and approval before release?
Are code changes traceable to a ticket and an approver?
Are development, staging and production environments separated?
Is there a documented rollback procedure that has been used?
Availability and incident response
What happens when something breaks or is breached.
Is there an incident response plan with defined severities and a communication path to customers?
Have backups been restore-tested in the last 12 months, with the result recorded?
Is there a business continuity or disaster recovery plan that has been exercised?
Are capacity and availability monitored against a stated commitment?